{
  "ml": {
    "v": "7",
    "eng": "2.6.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000030080477,
        "rte": "az",
        "prob": 0.000030080477
      },
      {
        "cls": 0,
        "raw": 0.00000014901161,
        "rte": "az/rpm",
        "prob": 0.00000014901161
      }
    ],
    "prob": 0.000030080477,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000030080476790317334,
        "type": "rpm"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010301669135515112,
        "type": "shell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-09T08:49:25Z"
  },
  "path": "dracut-live-109-2.fc45.aarch64.rpm",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(P)Md(Pa)",
        "sha": "abd35fbf9ecea113fe8c818e66cb09483949d77b805e2e46397a4428e344eb36",
        "path": "/tmp/promoter-618110428/abd35fbf9ecea113fe8c818e66cb09483949d77b805e2e46397a4428e344eb36/dracut-live-109-2.fc45.aarch64.rpm",
        "risk": 3,
        "size": 28399,
        "type": "rpm",
        "facts": {
          "metrics": {
            "rpm": {
              "buildtime": 1779850921.0
            },
            "file": {
              "size": 28399.0,
              "entropy": 6.45,
              "size_bytes": 28399.0
            },
            "binary": {
              "overall_entropy": 6.45,
              "peak_region_bytes": 10991.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "ident": {
          "name": {
            "value": "dracut-live",
            "source": "rpm.name",
            "verified": false
          },
          "urls": [
            {
              "url": "https://github.com/dracut-ng/dracut-ng/wiki/",
              "kind": "homepage",
              "source": "rpm.url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Fedora Project",
              "role": "packager",
              "source": "rpm.packager"
            }
          ],
          "version": {
            "value": "109",
            "source": "rpm.version",
            "verified": false
          },
          "organization": {
            "value": "Fedora Project",
            "source": "rpm.vendor",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "objectives/persistence/system/surface/paths::udev-exec-persistence",
            "atk": "T1547",
            "conf": 0.9,
            "crit": 3,
            "desc": "udev rule executes helper program",
            "from": [
              {
                "off": 212,
                "file": 1,
                "line": 6
              }
            ]
          },
          {
            "id": "objectives/persistence/system/surface/paths::udev-rules-path",
            "atk": "T1546",
            "conf": 0.86,
            "crit": 1,
            "desc": "udev rules persistence path",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/persistence/system/surface/paths::udev-run-program",
            "atk": "T1546",
            "conf": 0.86,
            "crit": 3,
            "desc": "udev rule executes helper",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::fedora-rpm-vendor",
            "conf": 0.99,
            "crit": 3,
            "desc": "Fedora Project RPM vendor identity"
          },
          {
            "id": "metadata/package/files/system-package::rpm-signature-present",
            "conf": 0.95,
            "crit": 3,
            "desc": "RPM signature header is present"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boXZ.B8\u0026{yx(kOBxBk8Rvrl05a%.hEz/^fCx(jn2arR!yx)a5GfjXTqfdFyTarR^HarR^HAb]VgBy(Tyq=#**nLR]wjT8g[a$K\u003cmrzC5ca$[1Dx(kOrzFsijB.bYbat2f^wPS3gwN(]nePkJrBzkP6at2f/zFs9kwGSTEvRGZkv@=c?By^4xC4CYgvr\u0026$wB0s\u003ebcM(U3arR^HarR^HarR^Ha%.IQz/o.xy?X67iXL2PB$Xm/ar\u00267TA=k(rbw.7qwJCk-au?$ifj/lnflH/pB$W(Uy?mVuwg]@2eN@*jvru6jz*2Yjy*?PwA=(hfA%:3jarR^HarU(px()Y]z/Ph}wP/gFzxHbGDVB4yBr+QoC4AZ.a{]CnarR^HarS:c3t1o!v*S",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "printf"
            ],
            [
              "",
              "wait_for_dev"
            ]
          ],
          "tgt": [
            "printf",
            "wait_for_dev"
          ],
          "metrics": {
            "ast": {
              "max_depth": 7,
              "call_count": 2,
              "node_count": 55
            },
            "file": {
              "size": 310,
              "entropy": 4.84
            },
            "text": {
              "lines": 9,
              "top_char": 101,
              "max_ws_run": 1,
              "digit_ratio": 0.01,
              "space_count": 55,
              "char_entropy": 4.84,
              "unique_chars": 55,
              "top_char_null": 0,
              "string_density": 0.56,
              "top_char_ratio": 0.08,
              "avg_line_length": 33.44,
              "max_line_length": 111,
              "empty_line_ratio": 0.11,
              "last_line_length": 4,
              "whitespace_ratio": 0.21,
              "identifier_density": 1.11,
              "line_length_stddev": 38.28,
              "normalized_string_count": 1.67,
              "repeated_char_sequences": 1,
              "normalized_unique_identifiers": 1.58
            },
            "binary": {
              "peak_region_bytes": 310,
              "peak_region_entropy": 4.84
            },
            "strings": {
              "bytes": 141,
              "count": 5,
              "avg_length": 28.2,
              "max_length": 92,
              "avg_entropy": 3.49,
              "entropy_stddev": 0.89
            },
            "comments": {
              "chars": 12,
              "count": 1,
              "lines": 1,
              "to_code_ratio": 0.13
            },
            "identifiers": {
              "count": 10,
              "unique": 5,
              "avg_length": 13,
              "max_length": 41,
              "min_length": 2,
              "avg_entropy": 2.47,
              "reuse_ratio": 0.5,
              "length_stddev": 14.39,
              "has_digit_ratio": 0.2,
              "high_entropy_count": 1,
              "high_entropy_ratio": 0.2,
              "all_lowercase_ratio": 0.6
            }
          }
        },
        "id": 1,
        "mol": "O(P)Md(Pa)",
        "path": "/tmp/promoter-618110428/abd35fbf9ecea113fe8c818e66cb09483949d77b805e2e46397a4428e344eb36/dracut-live-109-2.fc45.aarch64.rpm!!usr/lib/dracut/modules.d/70dmsquash-live-autooverlay/create-overlay-genrules.sh",
        "pid": 0,
        "risk": 3,
        "sha": "9ff2f56334360842a08d32fbd3b96463fc1addaf4c7bad187423a0b0bd52327f",
        "size": 310,
        "traits": [
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "spans": [
              [
                0,
                0
              ]
            ]
          },
          {
            "id": "metadata/package/files/dependency::os-image-root-file-path",
            "conf": 0.94,
            "crit": 3,
            "desc": "Root-level OS directory path",
            "spans": [
              [
                0,
                79
              ]
            ]
          },
          {
            "id": "objectives/persistence/system/surface/paths::udev-rules-path",
            "atk": "T1546",
            "conf": 0.86,
            "crit": 3,
            "desc": "udev rules persistence path",
            "spans": [
              [
                212,
                41
              ]
            ]
          },
          {
            "id": "objectives/persistence/system/surface/paths::udev-run-program",
            "atk": "T1546",
            "conf": 0.86,
            "crit": 3,
            "desc": "udev rule executes helper",
            "spans": [
              [
                48,
                37
              ]
            ]
          },
          {
            "id": "objectives/persistence/system/surface/paths::udev-exec-persistence",
            "atk": "T1547",
            "conf": 0.9,
            "crit": 3,
            "desc": "udev rule executes helper program",
            "uses": [
              2,
              3
            ],
            "spans": [
              [
                48,
                37
              ],
              [
                212,
                41
              ]
            ]
          }
        ],
        "type": "shell"
      }
    ],
    "rev": "46d16",
    "v": "8"
  }
}